Vulnerability Note VU#238678
The zlib compression library is vulnerable to a denial-of-service condition
Un-handled error conditions in the zlib compression library may allow an attacker to cause a denial-of-service condition.
There is a vulnerability in the error handling mechanisms of the decompression functions in the zlib compression library. The decompression functions inflate() and inflateBack() fail to handle certain error conditions properly. If an un-handled error condition is raised, the application linked to zlib may abruptly and abnormally terminate. This vulnerability may be exploited locally or remotely depending on the application being attacked.
This issue exists in zlib versions 1.2.0.x and 1.2.x, other versions are not vulnerable.
A malicious user may be able to intentionally raise an un-handled error condition by supplying the vulnerable functions with specially crafted compressed data. As a result, applications linked to the zlib library may abruptly and abnormally terminate resulting in a denial-of-service condition.
Check with Vendor
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|CVS Home||Affected||-||05 Oct 2005|
|Debian||Affected||01 Sep 2004||02 Sep 2004|
|libpng.org||Affected||01 Sep 2004||02 Sep 2004|
|MacSSH||Affected||27 Aug 2004||07 Sep 2004|
|Zlib.org||Affected||-||03 Nov 2004|
|AppGate Network Security AB||Not Affected||01 Sep 2004||02 Sep 2004|
|Apple Computer Inc.||Not Affected||-||17 Feb 2005|
|Aruba Networks||Not Affected||01 Sep 2004||13 Sep 2004|
|Bitvise||Not Affected||01 Sep 2004||13 Sep 2004|
|Certicom||Not Affected||01 Sep 2004||09 Sep 2004|
|Check Point||Not Affected||01 Sep 2004||07 Sep 2004|
|Chiaro Networks||Not Affected||01 Sep 2004||02 Sep 2004|
|Clavister||Not Affected||01 Sep 2004||02 Sep 2004|
|Cray Inc.||Not Affected||01 Sep 2004||01 Sep 2004|
|cryptlib||Not Affected||01 Sep 2004||07 Sep 2004|
CVSS Metrics (Learn More)
This vulnerability was reported by OpenPKG. We thank Mark Adler for providing information about this vulnerability.
This document was written by Jeff Gennari.
- CVE IDs: CAN-2004-0797
- Date Public: 25 Aug 2004
- Date First Published: 01 Oct 2004
- Date Last Updated: 05 Oct 2005
- Severity Metric: 0.66
- Document Revision: 335
If you have feedback, comments, or additional information about this vulnerability, please send us email.